Cite a source and recheck it later

Save a digest with every quote. One assess call before reuse says rely or do not rely, and why.

Who this is for

Research agents, answer engines and assistants that quote web pages, reports or datasets.

The problem

Within a few years most answers an agent gives will rest on sources it fetched. A URL is a weak citation: the page behind it can change, move or be corrected, and the agent has no way to tell. A record digest pins the exact text and its signer, and the registry tracks every correction and seal on it from then on.

How it works

• When the agent fetches a source, it hashes the bytes it read and asks the registry for the newest record about that file.
• It stores the record digest next to the quote, the same way it stores the URL.
• Before it reuses the quote, or when a user asks, it calls assess on the digest and acts on the verdict: rely, check or do_not_rely.
• A source with no record is not wrong. It is unattested, and the agent says so.

Routes it uses

• GET /v1/model/assess?asset={sha256}: rely, check or do_not_rely for the newest record about a file, with the reasons.
• GET /v1/model/assess/{digest}: rely, check or do_not_rely for one record, with the reasons.
• GET /v1/model/changes?entity=record:{digest}&cursor={cursor}: every state change for one record since the last cursor you read.

Set it up

Step 1. Hash what you read

Take SHA-256 over the exact bytes the agent fetched and used, before any cleanup or summarizing. Store it as lowercase hex.

Check: The same file always gives the same 64 hex characters.

Step 2. Find the record

Ask assess for the newest record about that hash. A 404 or not_found means no publisher has attested this file: keep the URL citation and mark it unattested.

curl -s -H 'Accept: application/json' 'https://aisourceoftruth.com/v1/model/assess?asset={sha256}'

Check: A known asset returns verdict and record; an unknown one returns not_found.

Step 3. Store the digest with the quote

Save record (the record digest) and the checkpoint as_of.tree_size with the citation. That pair is enough to recheck the source at any later time.

Check: Every stored citation that had a record carries its digest.

Step 4. Recheck before reuse

Before quoting again, call assess on the stored digest. rely: use it. check: read the reasons (an erratum, an upstream correction, a key revoked since) and tell the user. do_not_rely: drop it or say why it is unsafe.

curl -s -H 'Accept: application/json' 'https://aisourceoftruth.com/v1/model/assess/{digest}'

Check: A sealed or corrected test record changes the agent's answer.

Step 5. Watch long-lived citations

For citations you keep, such as a knowledge base, poll the change feed per record and recheck when anything changes.

curl -s -H 'Accept: application/json' 'https://aisourceoftruth.com/v1/model/changes?entity=record:{digest}&cursor={cursor}'

Check: A new erratum on a watched record shows up in the next poll.

Wire it into your agent

Put the hash and lookup in the tool that fetches sources, and the recheck in the step that assembles the final answer. Cache a rely verdict for the life of one answer, not longer.

MCP: add https://aisourceoftruth.com/mcp to the agent's MCP servers. Tools used: lookup, assess, get_model_changes. Read tools need no token.

With the PromptReports products, or alone

• PromptReports: PromptReports research reports carry a signed record each, so the agent can assess a report like any other source and cite its digest.
• CommitOps: When a cited claim backs a customer promise, link the record to that promise in CommitOps so a later correction reaches the promise.
• Alone: every step above uses only AI Source of Truth.

Expected outcomes

• Every citation that has a record carries a digest a reader can open.
• A correction or seal on a source changes the agent's next answer, with the reason.
• The agent can say which of its sources are attested and which are not.

What it does not prove

• A record shows who signed a file and when. It does not show that the file is true.
• rely means no correction, seal or revoked key is on record as of the checkpoint named. It is not a quality score.

The OpenSpec plan for your agent

Your coding agent fetches the plan and writes it into your repo as openspec/changes/integrate-aisot-source-citations/:

curl -H 'Accept: application/json' 'https://aisourceoftruth.com/use-cases/cite-sources/openspec?lang=python&with=promptreports,commitops'

• proposal.md: why, what changes in your product, impact.
• design.md: where the calls sit in your agent, with code for each call.
• tasks.md: checkable tasks, each step paired with a check against the live registry.
• specs/source-citations/spec.md: the requirements and scenarios.

Read it here: OpenSpec plan. Back to all use cases or the documentation library.